lywsvip/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2026-07-01 03:24:29 +08:00
Code Issues Packages Projects Releases Wiki Activity

[WIN32K] Fix 'use after free' in NtGdiStretchDIBitsInternal (#4122)

Browse Source 
CORE-17861
This commit is contained in:
Doug Lyons
2021-11-21 19:57:36 -06:00
committed by GitHub
parent f766ca5e42
commit b538b9abb8
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
win32ss/gdi/ntgdi/dibobj.c
View File

@@ -1489,7 +1489,6 @@ NtGdiStretchDIBitsInternal(
if (pdc) DC_UnlockDc(pdc);
}
if (pbmiSafe) ExFreePoolWithTag(pbmiSafe, 'imBG');
if (pvBits) ExFreePoolWithTag(pvBits, TAG_DIB);
/* This is not what MSDN says is returned from this function, but it
@@ -1504,6 +1503,8 @@ NtGdiStretchDIBitsInternal(
LinesCopied = pbmiSafe->bmiHeader.biHeight;
}
ExFreePoolWithTag(pbmiSafe, 'imBG');
return LinesCopied;
}